The FHA risksheet is a 12-column analysis tool designed for hazard identification and safety requirement allocation. It organizes failure conditions by system function, flight phase, and effect, then allocates Design Assurance Levels (DAL) and safety requirements per ARP 4761 classification standards.
Phase of flight when the failure condition occurs: pre-flight, takeoff, climb, cruise, descent, landing, post-flight, or continuous.
Effect Description
Text
(required)
Detailed description of the consequence of the failure condition on aircraft, crew, passengers, or operations. Must address safety impact per ARP 4761.
ARP 4761 classification: Catastrophic, Hazardous, Major, Minor, or No Safety Effect. Determines initial safety criticality.
Probability Target
Enumeration
See application
Required probability quantification per ARP 4761: Extremely Improbable (<10⁻⁹), Extremely Remote (<10⁻⁷), Remote (<10⁻⁵), or Reasonably Probable. Paired with severity.
DAL Level
Enumeration
Auto-calculated
Design Assurance Level (DAL A–E) allocated per classification. Auto-formula maps: Catastrophic→DAL A, Hazardous→DAL B, Major→DAL C, Minor→DAL D, No Safety Effect→DAL E.
The DAL column uses a JavaScript formula to automatically assign DAL based on the Severity Classification field. The mapping implements ARP 4761 standard classification-to-DAL correspondence. Manual override is permitted if safety engineering justifies a different allocation.
Identifier of the safety requirement derived from the failure condition (e.g., SR-001). Created and tracked as a safetyRequirement work item type.
Safety Requirement Title
Text
(required)
Descriptive title of the safety requirement that mitigates or eliminates the failure condition.
Safety Requirement DAL
Enumeration
Inherited
DAL level of the allocated safety requirement. Typically matches or inherits from the failure condition DAL.
The FHA-to-safety-requirement relationship creates the foundation of ARP 4761 safety case. Each failure condition must allocate at least one safety requirement. This establishes bidirectional traceability: failure conditions ↔ safety requirements.
Tracks evidence collection and approval state: Open (red), In Progress (yellow), Completed (green), Verified (dark green). Progresses as safety requirements are implemented and verified.
The FHA risksheet uses consistent ARP 4761-standard color coding across classification and DAL columns:
Severity Level
Color
RGB / Hex
Risk Profile
Catastrophic
Red
#e53935
Aircraft or personnel loss; uncontrollable
Hazardous
Orange
#fb8c00
Major injury; significant degradation
Major
Yellow
#fbc02d
Moderate injury; noticeable degradation
Minor
Green
#43a047
Minor injury; minor system effect
No Safety Effect
Grey
#78909c
No safety impact; possible operational impact
The row header in the risksheet adopts the classification color, providing visual emphasis. The DAL column uses the same color scheme, ensuring visual consistency between classification and allocated DAL.
The FHA risksheet uses an automatic formula to allocate DAL based on the severity classification, implementing the standard ARP 4761 mapping:
Severity Classification
Mapped DAL
Formula Logic
Catastrophic
DAL A
Highest assurance; highest-risk failures
Hazardous
DAL B
Intermediate-high assurance
Major
DAL C
Intermediate assurance
Minor
DAL D
Lower assurance; lower-risk failures
No Safety Effect
DAL E
Minimal assurance; non-safety-critical
The exact formula implementation (JavaScript variable names, case sensitivity) should be verified in the risksheet.json configuration attached to the FHA template module. The mapping above represents the semantic intent from ARP 4761.
Complete columnar view of all failure conditions, classifications, DAL allocations, and safety requirement assignments. Used for comprehensive hazard analysis and documentation.
Dedicated view for allocating safety requirements to failure conditions. Shows the traceability chain from failure condition → safety requirement with inherited DAL.
The FHA risksheet is instantiated once per project as the FHA document (e.g., FCC System Functional Hazard Assessment). The risksheet template includes:
Risk type: failureCondition
Task type: safetyRequirement
Link role: allocatesTo (failure condition allocates to safety requirement)
Hierarchy: Function → Failure Condition → Detail (3-level)
The systemElementId binding and document space location should be confirmed in the project’s FHA template module (e.g., modules/RiskTemplates/FHATemplate/module.xml).
The FHA is the entry point for ARP 4761 safety assessment. Its outputs feed downstream analysis:
Preliminary System Safety Assessment (PSSA): Accepts failure conditions and allocated safety requirements; develops detailed mitigation strategies.
System FMEA (SFMEA): Analyzes failure modes per customer requirement; links to failure conditions via the causes role.
Design FMEA (DFMEA): Analyzes failure modes per design characteristic; traces upstream to SFMEA.
FHA is the highest-level safety analysis. Downstream documents (PSSA, SFMEA, DFMEA) must remain traceable to FHA-allocated safety requirements. Breaking this traceability chain invalidates the safety case.
The FHA risksheet stores analysis metadata in standard work item custom fields:
The complete list of custom fields on the failureCondition and safetyRequirement work item types should be reviewed in the project’s custom-fields.xml configuration.
